Segfault on RTCW with Savage

A while back I mentioned on dri-devel that Savage cards will segfault RTCW
while loading the Checkpoint demo.
( http://www.nixnuts.net/benchmarks/current/ ) The problem is in
Mesa/src/mesa/tnl/t_tertex.c around lines 741 and 913.
for (j = 0; j < count; j++) {
GLvector4f *vptr = VB->AttribPtr[a[j].attrib];
a[j].inputstride = vptr->stride;
...
}
vptr is null in the middle of the for loop ( j=2 is null j=0, 1, and 3 is
valid.) I have no idea why this is the case, but I've attached a simple fix
which eliminates the problem.
John Lightsey